PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what it is and how to protect your servers

Quick answer: PHP2Shell is a pair of critical PHP flaws that let attackers take over web servers without logging in. Every PHP version before the fixed releases is affected, and attacks are already under way. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart PHP, and check exposed servers for signs of compromise. Every Defense.com customer can run a free application scan to check their websites. Here's how to check if you're affected.

What is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in PHP, the language behind WordPress, Drupal, Magento and much of the web. They could let attackers run code on web servers remotely, without logging in. Both have a CVSS v4.0 score of 9.2.

• CVE-2026-109618: running out of memory can interrupt PHP while request data is only partly set up, and cleanup may then treat that invalid data as valid.
• CVE-2026-109619: data from one request can survive after its memory is freed, and a later request handled by the same worker may use it.

The NCSC is encouraging UK organizations to take immediate action, and CERT-EU issued Security Advisory 2026-018 on 21 October.

Is PHP2Shell being exploited?

Yes. Amazon Threat Intelligence spotted an exploitation attempt on 17 October, four days before public disclosure, and says PHP2Shell is now being broadly exploited. Proof-of-concept exploits were circulating before the fixes arrived. If you have unpatched PHP facing the internet, assume it's being targeted.

Am I affected?

Every version of PHP before the fixed releases below is affected. PHP says every installation that handles web requests is potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php is the highest risk, as an attack can succeed before your application code even runs.

How do I check my servers?

Free application scan for every customer: In response to PHP2Shell, we're giving every Defense.com customer access to run a free application scan against their websites. If you need to scan more sites or want help reviewing your results, get in touch with our team.

Defense.com customers can find exposed PHP sites with App Scanning and Vulnerability Scanning. As scanners detect PHP by version, confirm results with a few manual checks, particularly on Linux, where distributions often backport fixes without changing the version number.

Our help center guide walks through scanning and the manual checks: How to check if you're affected by PHP2Shell.

How do I fix PHP2Shell?

1. Update PHP to a fixed version or your vendor's patched package, starting with mod_php servers as they're at the highest risk. This is the only complete fix.
2. Restart PHP (PHP-FPM, Apache, FrankenPHP, LiteSpeed or php-cgi workers). The fix doesn't take effect until running workers restart.
3. Check for compromise, even after patching (see below).
4. Plan upgrades for PHP 8.1 and older. These are end of life, so migrating to a supported branch is required.

What if I can't patch straight away?

PHP has published temporary mitigations. They reduce risk but don't remove it, so patch as soon as you can.

• Apply both settings together, in a way applications can't override (for example, php_admin_value in your FPM pool or Apache config), then restart every worker:
  • session.upload_progress.enabled = 0 (CVE-2026-109619)
  • memory_limit = -1 (CVE-2026-109618)
• Cap memory at the operating system level. Setting memory_limit = -1 removes PHP's own limit, so use a container or cgroup limit as a boundary.
• Reduce upload sizes. PHP suggests a low post_max_size: 8M if your application doesn't need uploads, or 32M if it does.
• Restrict access to affected applications with IP allowlisting or geo-blocking until they're patched.
• Undo the memory change once you've updated, and restore a finite memory limit. You can leave upload progress disabled if you don't use it.

How do I know if I've been compromised?

As attacks began before the patch, check any server that was exposed. Signs include unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, unexplained PHP worker restarts, web shells, unexpected files, new admin users, modified PHP files and odd outbound connections.

If you send web server and PHP logs to the Defense.com SIEM, our SOC monitors them 24/7 for suspicious activity. If you think a system has been compromised, click Incident Response in the left-hand navigation of your Defense.com account to raise an incident with our SOC.

Is Defense.com affected by PHP2Shell?

We checked our own systems as soon as PHP2Shell was disclosed. One internal system was running an affected version of PHP. We updated it to PHP 8.4.27, the patched release, on 22 October.

That system was behind a firewall that only allows access from a small number of IP addresses under our control, and we have found no signs of exploitation or unauthorised access. We have not found any other Defense.com systems running PHP applications, including the Defense.com platform itself.

Sources: the NCSC alert, the PHP security advisories for CVE-2026-109618 and CVE-2026-109619, CERT-EU Security Advisory 2026-018 and Amazon Threat Intelligence.